The way every agent framework handles MCP is a latent security problem

Re:The way every agent framework handles MCP is a latent sec... by yjcho9317 on Wednesday April 08, 2026 @05:13AM (#47687475)

Yeah, I hit this. I run an MCP server that talks to a corporate messaging API — if it stays connected the whole session, any hallucinated tool call can fire off messages to an entire org while the agent is doing something unrelated.

There's no real reason that connection needs to stay open the whole time. Feels like overkill.

Read-only stuff is probably fine staying persistent, I guess. Anything that sends or mutates state feels different though.

MCP doesn't really have a way to express that kind of boundary per tool, so the runtime can't do much with it.

Haven't tried Orloj yet but "summoned on demand" sounds closer to what I'd want.

[ Parent | on HN ]

Re:The way every agent framework handles MCP is a latent sec... by An0n_Jon on Wednesday April 08, 2026 @01:47PM (#47693727)

Yeah, agreed it feels like overkill keeping the resource running if nothing is calling it. Even with read only you still have the issue with wasted resources but I get what you mean.

Orloj is a runtime with policies you apply as guardrails to keep agents in check for tools and other limits which all happen at the runtime level. And building out the tooling it just made sense to containerize tools so they can be spun up on demand and stay alive when needed and spin down after.

[ Parent | on HN ]